VulnerabilityModified

CVE-2023-22652

A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf leads to DoS via malformed config files.

MEDIUM 6.5EPSS 0.64%

Does this matter?

Lower severity and a low EPSS score (0.64%). Track it; it rarely justifies an emergency change on its own.

Description

A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf leads to DoS via malformed config files. This issue affects libeconf: before 0.5.2.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS: 0.64% probability · 49th percentile
CISA KEV: Not listed
Weakness: CWE-120
Affected: opensuse/libeconf
Source: meissner@suse.de

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22652Issue Tracking, Vendor Advisory
https://https://github.com/openSUSE/libeconf/issues/177Broken Link
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SDD5GL5T3V5XZ3VFA4HPE6YGJ2K4HHPC/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SMG5256D5I3GFA3RBAJQ2WYPJDYAIL74/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAYW7X753Z6GOJKVLQPXBDHISN6ZT233/
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22652Issue Tracking, Vendor Advisory
https://https://github.com/openSUSE/libeconf/issues/177Broken Link
https://lists.debian.org/debian-lts-announce/2025/05/msg00016.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SDD5GL5T3V5XZ3VFA4HPE6YGJ2K4HHPC/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SMG5256D5I3GFA3RBAJQ2WYPJDYAIL74/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAYW7X753Z6GOJKVLQPXBDHISN6ZT233/
https://github.com/openSUSE/libeconf/issues/177

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.